From c4dabeeef4781dc6a434bbceda175daa50149c3f Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Fri, 27 Mar 2026 20:48:35 +0100 Subject: [PATCH] fix CVE data sync and signalr join --- .claude/commands | 2 +- .../AutopilotMonitor.Agent/buildcounter.txt | 2 +- .../VulnerabilityDataSyncFunction.cs | 11 ++++--- .../Security/EndpointAccessPolicyCatalog.cs | 4 +-- .../VulnerabilityCorrelationService.cs | 31 +++++++++++++------ 5 files changed, 32 insertions(+), 18 deletions(-) diff --git a/.claude/commands b/.claude/commands index 93d356af..4d307c96 160000 --- a/.claude/commands +++ b/.claude/commands @@ -1 +1 @@ -Subproject commit 93d356afd4e71a1f87abc4f1b33b3cb83625fb6a +Subproject commit 4d307c96dcdd2b93e9219d35af90901803ad0250 diff --git a/src/Agent/AutopilotMonitor.Agent/buildcounter.txt b/src/Agent/AutopilotMonitor.Agent/buildcounter.txt index 37985410..d8560d5c 100644 --- a/src/Agent/AutopilotMonitor.Agent/buildcounter.txt +++ b/src/Agent/AutopilotMonitor.Agent/buildcounter.txt @@ -1 +1 @@ -623 +627 diff --git a/src/Backend/AutopilotMonitor.Functions/Functions/Vulnerability/VulnerabilityDataSyncFunction.cs b/src/Backend/AutopilotMonitor.Functions/Functions/Vulnerability/VulnerabilityDataSyncFunction.cs index 5a77d011..042f0498 100644 --- a/src/Backend/AutopilotMonitor.Functions/Functions/Vulnerability/VulnerabilityDataSyncFunction.cs +++ b/src/Backend/AutopilotMonitor.Functions/Functions/Vulnerability/VulnerabilityDataSyncFunction.cs @@ -200,11 +200,14 @@ namespace AutopilotMonitor.Functions.Functions.Vulnerability var cveDataJson = System.Text.Json.JsonSerializer.Serialize(cves); - // Guard 64KB limit - if (cveDataJson.Length > 60_000) + // Guard 64KB limit — iteratively halve until it fits + var cacheCves = cves; + while (cveDataJson.Length > 60_000 && cacheCves.Count > 10) { - var reduced = cves.Take(cves.Count / 2).ToList(); - cveDataJson = System.Text.Json.JsonSerializer.Serialize(reduced); + cacheCves = cacheCves.Take(cacheCves.Count / 2).ToList(); + cveDataJson = System.Text.Json.JsonSerializer.Serialize(cacheCves); + _logger.LogInformation("[VulnSync] Reduced CVE cache for {CpeUri} to {Count} entries ({Bytes} chars)", + cpeUri, cacheCves.Count, cveDataJson.Length); } var data = new Dictionary diff --git a/src/Backend/AutopilotMonitor.Functions/Security/EndpointAccessPolicyCatalog.cs b/src/Backend/AutopilotMonitor.Functions/Security/EndpointAccessPolicyCatalog.cs index 47d9345e..f67a7f06 100644 --- a/src/Backend/AutopilotMonitor.Functions/Security/EndpointAccessPolicyCatalog.cs +++ b/src/Backend/AutopilotMonitor.Functions/Security/EndpointAccessPolicyCatalog.cs @@ -92,8 +92,8 @@ public static class EndpointAccessPolicyCatalog new("GET", "auth/me", EndpointPolicy.AuthenticatedUser), new("GET", "auth/is-global-admin", EndpointPolicy.AuthenticatedUser), new("POST", "realtime/negotiate", EndpointPolicy.AuthenticatedUser), - new("POST", "realtime/groups/join", EndpointPolicy.AuthenticatedUser), - new("POST", "realtime/groups/leave", EndpointPolicy.AuthenticatedUser), + new("POST", "realtime/groups/join", EndpointPolicy.MemberRead), + new("POST", "realtime/groups/leave", EndpointPolicy.MemberRead), new("GET", "progress/sessions", EndpointPolicy.AuthenticatedUser), new("GET", "progress/sessions/{sessionId}/events", EndpointPolicy.AuthenticatedUser), new("PUT", "preview/notification-email", EndpointPolicy.AuthenticatedUser), diff --git a/src/Backend/AutopilotMonitor.Functions/Services/Vulnerability/VulnerabilityCorrelationService.cs b/src/Backend/AutopilotMonitor.Functions/Services/Vulnerability/VulnerabilityCorrelationService.cs index b29ed1e3..3ca21611 100644 --- a/src/Backend/AutopilotMonitor.Functions/Services/Vulnerability/VulnerabilityCorrelationService.cs +++ b/src/Backend/AutopilotMonitor.Functions/Services/Vulnerability/VulnerabilityCorrelationService.cs @@ -474,20 +474,31 @@ namespace AutopilotMonitor.Functions.Services.Vulnerability // Persist to repository (best-effort, don't fail the request) try { - var cveDataJson = JsonSerializer.Serialize(cves, JsonOptions); + var cacheCves = cves + .OrderByDescending(c => c.CvssScore) + .ThenByDescending(c => c.PublishedDate) + .ToList(); + var cveDataJson = JsonSerializer.Serialize(cacheCves, JsonOptions); // Guard against exceeding Table Storage 64KB single-property limit + // Iteratively halve until it fits (floor: 10 CVEs) + while (cveDataJson.Length > 60_000 && cacheCves.Count > 10) + { + cacheCves = cacheCves.Take(cacheCves.Count / 2).ToList(); + cveDataJson = JsonSerializer.Serialize(cacheCves, JsonOptions); + _logger.LogInformation("Reduced CVE cache for {CpeUri} to {Count} entries ({Bytes} chars) to fit 64KB limit", + cpeUri, cacheCves.Count, cveDataJson.Length); + } + + // Last resort: strip Criteria strings (biggest space consumer) and retry if (cveDataJson.Length > 60_000) { - // Further reduce until it fits - var reduced = cves - .OrderByDescending(c => c.CvssScore) - .ThenByDescending(c => c.PublishedDate) - .Take(cves.Count / 2) - .ToList(); - cveDataJson = JsonSerializer.Serialize(reduced, JsonOptions); - _logger.LogInformation("Further reduced CVE cache for {CpeUri} to {Count} entries to fit 64KB limit", - cpeUri, reduced.Count); + foreach (var c in cacheCves) + foreach (var v in c.AffectedVersions) + v.Criteria = null; + cveDataJson = JsonSerializer.Serialize(cacheCves, JsonOptions); + _logger.LogWarning("Stripped Criteria from CVE cache for {CpeUri} to fit 64KB limit ({Bytes} chars)", + cpeUri, cveDataJson.Length); } var data = new Dictionary